This Privacy Policy explains how Tickflow Capital Limited collects, uses, stores, and protects personal data, in compliance with Kenya's Data Protection Act 2019 (DPA) and applicable international standards.
Tickflow Capital Limited ("Tickflow Capital", "we", "us", or "our") is a trading technology and quantitative research company incorporated in Kenya under the Companies Act 2015.
We operate the website tickflowcapital.com and the TIES (Trading Intelligence & Execution System) platform. In the context of this Privacy Policy, we are the data controller for personal data collected through our website and communications. Where we process data on behalf of commercial clients, we may act as a data processor as defined in the Kenya Data Protection Act 2019.
We collect personal data only to the extent necessary for legitimate business purposes. We do not collect excessive, irrelevant, or speculative data.
| Category | Examples | How Collected |
|---|---|---|
| Identity data | Full name, job title, company name | Contact form, email enquiries |
| Contact data | Email address | Contact form, direct email |
| Communication data | Content of messages, enquiry type, message body | Contact form submissions |
| Commercial data | Product interest, firm type, use case descriptions | Contact form selection fields |
| Category | Examples | Purpose |
|---|---|---|
| Technical data | IP address, browser type, operating system | Security, fraud prevention |
| Usage data | Pages visited, time on site, referral source | Analytics (if enabled) |
| Device data | Screen resolution, device type | Site optimisation |
We do not collect:
We use personal data only for specified, explicit, and legitimate purposes. We do not use data for automated profiling or decision-making that produces legal effects.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Responding to enquiries and contact form submissions | Identity, contact, communication data | Legitimate interest / Contractual necessity |
| Providing information about our products and services | Identity, contact, commercial data | Legitimate interest / Consent |
| Managing commercial relationships and contracts | Identity, contact, commercial data | Contractual necessity |
| Complying with legal and regulatory obligations | As required by law | Legal obligation |
| Improving our website and services | Technical, usage data (anonymised) | Legitimate interest |
| Security monitoring and fraud prevention | Technical data | Legitimate interest |
We do not use your personal data for unsolicited marketing, selling to third-party advertisers, or any purpose not listed above. We do not sell personal data.
Under the Kenya Data Protection Act 2019, we process personal data on the following lawful bases:
Where we rely on consent, you have the right to withdraw that consent at any time by contacting us at info.tickflowcapital@gmail.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
We do not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances:
We engage the following third-party service providers who may process personal data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare Inc. | CDN, DDoS protection, DNS, security | United States |
| Web3Forms | Contact form submission processing and email delivery | United States |
| Stripe Inc. (future Phase 4) | Payment processing for commercial subscriptions | United States |
| Oracle Cloud Infrastructure | VPS hosting for backend services | United States / Global |
| GitHub Inc. | Source code hosting and site deployment | United States |
All service providers are contractually bound to process personal data only on our instructions and in accordance with applicable data protection laws.
We may disclose personal data to:
In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the acquiring entity. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.
| Data Category | Retention Period | Basis |
|---|---|---|
| Contact form submissions (general enquiries) | 12 months from date of submission | Legitimate interest in follow-up and business development |
| Commercial correspondence and contracts | 7 years from contract end date | Kenya Companies Act; tax and legal obligations |
| Payment records (if applicable) | 7 years | Kenya Tax Procedures Act 2015 |
| Technical logs (server, security) | 90 days | Security monitoring and incident investigation |
| Marketing communications data | Until consent is withdrawn, or 2 years of inactivity | Consent |
When personal data is no longer required, we securely delete or anonymise it. Anonymised data (which can no longer identify you) may be retained indefinitely for research and analytical purposes.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure.
No transmission of data over the internet is completely secure. While we take all reasonable precautions, we cannot guarantee the absolute security of data transmitted to or from our website.
As a data subject, you have the following rights under the Kenya Data Protection Act 2019:
| Right | What It Means |
|---|---|
| Right of access | You may request confirmation of whether we hold your personal data and obtain a copy of it. |
| Right to rectification | You may request correction of inaccurate or incomplete personal data. |
| Right to erasure | You may request deletion of your personal data where there is no compelling reason for its continued processing. |
| Right to restriction | You may request that we restrict the processing of your data in certain circumstances. |
| Right to data portability | You may request a copy of your data in a structured, machine-readable format. |
| Right to object | You may object to processing based on legitimate interests or for direct marketing purposes. |
| Right to withdraw consent | Where we rely on consent, you may withdraw it at any time without affecting prior processing. |
To exercise any of these rights, contact us at info.tickflowcapital@gmail.com. We will respond within 30 days. We may require you to verify your identity before processing your request.
If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.
Some of our third-party service providers are located outside Kenya (primarily in the United States). When we transfer personal data internationally, we ensure appropriate safeguards are in place, including:
By submitting data through our website, you acknowledge that your data may be transferred to, stored, and processed in countries outside Kenya, subject to the safeguards described above.
Our website and services are intended solely for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18 years of age. Our products involve financial technology and trading systems that are not appropriate for minors.
If we discover that we have inadvertently collected personal data from a minor, we will delete that data immediately. If you believe we have collected data from a minor, please contact us at info.tickflowcapital@gmail.com.
Our website uses limited cookies for essential functionality. We do not use advertising cookies, cross-site tracking, or third-party analytics tools that collect personal data without your consent.
For full details on the cookies we use, how we use them, and how to control them, please read our Cookie Policy.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or operational changes. When we make material changes, we will:
We encourage you to review this policy periodically. Your continued use of our website or services after changes are posted constitutes your acceptance of the updated policy.
For questions, concerns, or requests relating to this Privacy Policy or your personal data:
We aim to respond to all privacy-related enquiries within 30 calendar days. For formal complaints, you may also contact the Office of the Data Protection Commissioner of Kenya.